Idaho · verified official-source register

Idaho Privacy Enforcement Cases

3 approved, official-source case records from the 50-state register. Dates, amounts, legal context and disposition qualifications are supported by the cited evidence.

3 primary case-source links · 3 unique primary source URLs

Last editorial review (targeted corrections): · Last link check (automated availability check):

Actual case links

Idaho case register

Each record cites an official Attorney General or state-agency source. Shared multistate amounts should not be summed as unique state penalties. Additional verification sources are identified when an amount has been reconciled.

Verified case 1 of 3

Retrieval-Masters Creditors Bureau, under the name American Medical Collection Agency (AMCA)

Date
December 9, 2020
Amount
$21 million total payment to the states; Idaho share not stated; payment suspended unless the company violates certain settlement terms
Legal basis
No statutes or laws cited in the document

Why the action was brought

An unauthorized user accessed AMCA’s internal system between August 2018 and March 2019. AMCA failed to detect the intrusion despite warnings from payment-processing banks. The breach exposed Social Security numbers, payment card information, and, in some instances, names of medical tests and diagnostic codes belonging to more than 7 million people nationwide, including 3,068 Idaho residents.

View Official Case Source ↗ (opens in a new tab)

Verified case 2 of 3

Experian; T-Mobile; Experian Data Corp. (“EDC”)

Date
not stated in the official release
Amount
More than $16 million paid by the companies to the states; Idaho will receive $172,000. T-Mobile’s separate settlement is $2.43 million. Experian will pay an additional $1 million to resolve the EDC investigation.
Legal basis
Idaho Code

Why the action was brought

The 2015 Experian breach exposed names, addresses, dates of birth, Social Security numbers, identification numbers, and related credit-assessment information of consumers applying for T-Mobile services. An unauthorized actor accessed Experian’s network. EDC’s 2012 breach involved an identity thief obtaining sensitive personal information after posing as a private investigator, and EDC failed to prevent or provide notice.

View Official Case Source ↗ (opens in a new tab)

Verified case 3 of 3

Carnival Cruise Line

Date
not stated in the official release
Amount
$1.25 million multistate settlement; Idaho will receive $13,088
Legal basis
Idaho law; state breach notification statutes

Why the action was brought

An unauthorized individual accessed Carnival employee email accounts containing names, addresses, passport and driver’s license numbers, payment card and health information, and some Social Security numbers. Carnival became aware of suspicious activity in May 2019 but reported the breach approximately 10 months later, raising concerns about email security and delayed breach notification.

View Official Case Source ↗ (opens in a new tab)

This register contains approved, official-source privacy, data-breach and data-security enforcement records. Read any case-specific court-approval qualification; inclusion does not confirm payment or final judgment. Shared multistate amounts should not be summed as unique state penalties.

Educational information, not legal advice.

Back to IdahoAll states

Original case-library snapshot: August 23, 2026. Original state-law research cutoff: August 25, 2026. Monetary-library update: September 16, 2026, not a new full 50-state research cutoff. Targeted Indiana and New Hampshire law review: October 19, 2026 only. Source inclusion does not independently confirm final court entry or payment.